General
-
Target
https://drive.google.com/uc?id=1DC4a9zW6ihNT3EbsZi9YnDUGkhDHw-iu&export=download&authuser=0
-
Sample
240925-zr95nsxdqr
Score
10/10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/uc?id=1DC4a9zW6ihNT3EbsZi9YnDUGkhDHw-iu&export=download&authuser=0
Resource
win11-20240802-en
20 signatures
300 seconds
Malware Config
Extracted
Family
asyncrat
Version
| CRACKED BY https://t.me/xworm_v2
Botnet
MAXIMO4
C2
delonuevomision.con-ip.com:2625
Mutex
tempcookiee
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Targets
-
-
Target
https://drive.google.com/uc?id=1DC4a9zW6ihNT3EbsZi9YnDUGkhDHw-iu&export=download&authuser=0
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Executes dropped EXE
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Suspicious use of SetThreadContext
-